8afeca55b8a045032df013b6c74e6e527a1b7d2947bc3fc942c3a0a8949a801f

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1042e5f3c806ec59197c9efa67d57176_JaffaCakes118.html
Size

448B
MD5

1042e5f3c806ec59197c9efa67d57176
SHA1

d305ebfcf3b181249a6a73338061d50a8677e6d0
SHA256

8afeca55b8a045032df013b6c74e6e527a1b7d2947bc3fc942c3a0a8949a801f
SHA512

3e0c76d9498cb6d3aecf9300a886e418b9aa783861d7f66616af9c22fca2aea730e988ad7e1ffe250b0ffa27264d2d4258fb3d97813720a2c99573fe09029ba7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E42ADB51-0934-11EF-A596-F62ADD16694A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000007c0a8449e194ae97ba4c2f95c9f5a62ba3f014a3c37063e85a8250b451e3964b000000000e80000000020000200000000b187ce8f24b7ef45b5a6cf3fb0ff3914797d39af03167841adcdbbfc510e3f320000000659081179b9b68504594c0bf5ca5695f98e6243a925367e88e3aa5753ef5a510400000004105fd97bde2daa033b4edcc61890dfb387d4f8e95f35dd8af5702feb5cf6c1523a7509bf93677ad20980fcd156f0c4c08c633cd68993638775be8317b078504	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000f4ce2829cd1467744878b9de8f91af495894c9652560abe301027f11f4f164a000000000e800000000200002000000048dafbb69731f6788e804e92d56c38045d30a77f43c4c47e08750610b74cefbf90000000ac1cb8dd216c718a9a857b005e5cfb4be3a3d8db6ea12e61035f64d3c6ffe15c0759cadbede7109cb3b1a57f0f190aba289ae9779ab10464d22aae3e9e5239aed5abcff85e93152f05df88a7bd2a03e9d953fe61cc9b46c36f45dcefe87150c3d3e49aa0a2562d7281b6c3738f867cbce9463b1353d7f4f86a25c1824e4e062d422a1927ac9ede1c1b862ffb6c06500c40000000f34dc91f980dd33fadca8f6f68b652aa43969029a3d878ddf5392afc9635cd318fd832e8f74d530cbff19dd6a8d4e74d254f78fbd0373378b48636d60341878a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420892691"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004ce3a6419dda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2616	iexplore.exe
2616	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2644	2616	iexplore.exe	28
PID 2616 wrote to memory of 2644	2616	iexplore.exe	28
PID 2616 wrote to memory of 2644	2616	iexplore.exe	28
PID 2616 wrote to memory of 2644	2616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1042e5f3c806ec59197c9efa67d57176_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c404225dd8f1048ad713d1d62f97f456

SHA1
f69868b71752c6022cb0040aa93f8e658e4f623a

SHA256
9354d33c44c278641dacc326d34c057107667216fb5964919c926a6b53d4b5b3

SHA512
92e49ddc9e30e18b007e2898ecc456450dfbf819631f4ccbef68eb78a34daec8bbdc16da7b0d27f9d53752b3d4d60d809a5e415740dc092db9dbd6f7de6d2c6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7598bd649e5adbada74ccbaefcaa8613

SHA1
c829db22a59fcad24f1a7fd5d3237abaf2d83b30

SHA256
9ff09bb1e63264f08ac6d4dd7198591d7ece921a3d92cbefbef491b988f49a3f

SHA512
16648a286c92cc95eefa9695b65ebfe1b52e54f8c35da69d7508443b337335f9ddb899222fb9a35799ce40317d16a963b7c501f537e4cb31a7fb22e960379f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecfb38dc513efcf53e579ff2f8bf03f0

SHA1
2da737710c7e88cf2c9f460e9e69df80a5b20758

SHA256
f50a228003ce6300353d9dddfac1373e85240018ad53ac452e0f6df16f0f2af1

SHA512
12de6007e74003fb79619dbde88584600dcff819f57e4310fc5bb467c922eb588b70c29bb1e014afab50e7b04e0973fc57c53ef27f688f5d93bdf2af4383ca9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5becfd57bb56ad60076eecd6a162986

SHA1
95920f974af32cdbaf884a07f4bc5ae2f8365a3d

SHA256
31a48a875865a750eba35481d7d807d2f4580cd7ab9e68e981b31b9428f60cfc

SHA512
db999659d6dd9024d1122462800018ecebdcc2375ef575958e5f050e47b12fa6dd758372feee364eecef03cab65d9b4f6b1a6039c79d0bb9abd586a7af8609c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ecc6b24ff7d2ba7406c95fae174c92c

SHA1
b53edcbeaffc75b6117c5e57fbfff15dd28b2eca

SHA256
217d44f4d5acf18f69ca6db5538eb2b09161af01e1e68d64411e335711316582

SHA512
add986156cd4fabea3acea30178944ea75dafa10c4d3924ba13e3da56bc09e4bcaa9d0e199a2e8afdf3eaa36da65e649bef8e9a33723ed04db73f4501c4c9cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d50b7eef934b2bf6d4cebc883f0d207

SHA1
e1c7715a2ec2271aeaa23180feb17316944b0fa6

SHA256
ec83a751d0a3a825d47cbb68eb9142a696f8522c897389304b66949f3fa5a129

SHA512
ea9a0732b7f8bb6da83b87d9aada6aa0ca56567502315d258b9867aa6553f49faa316bdd42b1f76c48d533cf840da697a0c671fd28178f18d14fb3d45e311877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06ffc3ad77e06a61973a7fbc1a72feb7

SHA1
cc86db6f67be503677f8abc0b2f748d920736771

SHA256
8b39e949d11b82795483a212906eff0c46ccb35b37434826df564ad5733f585d

SHA512
1351276fe38969552dbf4e8f9185c39381ef7d5fffc57120cee24bdaab2be09d602f1faacbd28b076a9c341d4fdfe085cdb6cb5b69b9ae206638ab48276aa912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f8e58c26a00ce1325c20b11e4f98bf

SHA1
42a88cfc11b68c2adea046f757d50352acdc90e8

SHA256
9c5b6928eebc03d6b993906747e213b16648596a0f40b4b3a71b04895baf8ee3

SHA512
70bb909d479e88821a1f27a34e8c1e9c737e6f17b2e8f1492c09eabbd618aa85cbf771bbe36eb11886677c9d16093f0ec3ea09785e619c564bfb8a688eb6f756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12662eb3b611c2c878b4ebb111f3f3d5

SHA1
a6257428704e29139d68cf48548345f2d549c795

SHA256
33881759b7f9d06c159a4a75581c9ee6295c6346863ef2b53fb015142c161dbf

SHA512
6e9d68b5d82cec24e7c41e557ff4d5d51a3513e50d077db2f5b970227aa2f2da75d947dea02e01916861f018d889ddeef38fd683dfd1e0bd37045719743e32dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eeab9b6e0fe870e901e37d9b05f41ca1

SHA1
5d4a2c32fe30ea27c427cdee810660a14f9e8b6c

SHA256
cb66c59292b460988b75bf89d7089a050b576b7857b5f1c2a1704ce077c84143

SHA512
bea7fab610f50e1463d30f2b22769b832301f23f1bffdcea8d01fff819e21f2855327cab34256f5a77cee0d904f9a1a04f36b037dc6214c93cf162c7cf2501c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9e1692b9aa115004b4e14187b915d35

SHA1
d788a3a898c846e15b65795f82b3e87f4d4937fb

SHA256
1afedb7d9593a3baef3d0fd76886a01a0f5ef890637a979924a77f9ff9f27b3f

SHA512
b0618f50326b5b6240083ea101a4ed44279e1114af8a1a16e3243fba0e1201ad33fedfe010415cd4e2de07fe619996c3ba2b213da1ea5bc2f74b81d7b0ec841b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2993.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A84.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit